CVE-2022-43717 Apache Superset: Cross-Site Scripting on dashboards

2023-01-1610:08:04

CWE-79

apache

www.cve.org

apache superset

xss

cve-2022-43717

cross-site scripting

dashboard

authentication

EPSS

0.001

Percentile

32.6%

JSON

Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Superset",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.0.1",
        "status": "affected",
        "version": "2.0.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "1.5.2",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

References

lists.apache.org/thread/g6zy6vkpvkbj5mj32vmyzwol5ldtg9pl

EPSS

0.001

Percentile

32.6%

JSON

Related for CVELIST:CVE-2022-43717